Claims 

The claims are amended as follows: 

1 . (Currently Amended) A traffic measurement system comprising: 

a plurality of measurement devices that collect packets flowing through Internet links 
between routers, extract traffic data required to analyze traffic from the collected packets, and 
process the extracted data into predetermined flow types; and 

an analysis server that identifies applications of traffic by analyzing the traffic data 
transferred from th e pl urality of measurement devices a s a wh o l e, classifies the identified 
applications into predetermined traffic types, and outputs the classification result, wh e r e in 
analyzing th e traffic d at a incl ude s analyzing p ayload data includ e d in the tr affic data and th e 
traffic typ e s including a traffic typ e that is id e ntifi e d ba se d on an application signatur e fr om other 
flows since t he port numb e rs a re ex ch an g e d th r o ugh oth e r control flows 

and the traffic types comprise: 

a first traffic type whose applications are identified using only TCP/UDP port 

numbers; 

a second traffic type whose application is identified bv collecting application 
headers and application signatures that are included in payloads of the packets; 

a third traffic type whose applications are identified by extracting application data 
from the second traffic type, since application data is not included in reverse traffic of the 
1 ' " id traffic type; 

a forth traffic type whose applications are assigned predetermined port numbers 
are identified based on application signature of other flows since the port numbers are 
exchanged through an other control flow; and 

a fifth traffic type whose applications are not classified into the first through the 
fourth traffic types . 

2. (Original) The traffic measurement system of claim 1 , further comprising a plurality of 
time receiving devices that extract time signals from a GPS satellite or a CDMA base station to 
synchronize the times of the plurality of measurement devices. 

3. (Previously Presented) The traffic measurement system of any one of claims 1 and 2, 
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wherein each of the plurality of measurement devices comprises: 

a packet collection unit that collects the packets flowing through the Internet lines from 
router connection lines and records the collection times of the packets; 

a flow generation unit that generates flows using the packets having the same data 
including a target address, a protocol, and a port number, from the packets collected by the 
packet collection unit, extracts data required for detailed analysis of the applications after 
analyzing the contents of the packets, and stores the extracted data according to the flow; and 

a transfer unit that transfers the data stored in the flow generation unit to the analysis 
server according to a predetermined time interval. 

4. (Original) The traffic measurement system of claim 3, wherein the packet collection unit 
collects the packets by using one of tapping, port mirroring, and signal distribution. 

5. (Original) The traffic measurement system of claim 3, wherein the data required for 
detailed analysis of the applications are application signatures for identifying the applications in 
payload of the packets. 

6. (Original) The traffic measurement system of any one of claims 1 and 2, wherein the 
analysis server comprises: 

a data receiving unit that receives the packet data from the plurality of measurement 
devices; 

a traffic analysis unit that analyzes the data provided from the plurality of measurement 
devices via the data receiving unit as a whole, and classifies the applications into the traffic types 
according to the analysis result; 

a data storing unit that stores the traffic analysis result of the traffic analysis unit; and 
a user interface that displays the traffic analysis result stored in the data storing unit to a 
user after processing the traffic analysis result into various types desired by the user. 

7. (Original) The traffic measurement system of claim 6, wherein the analysis server further 
comprises a report output unit that processes the traffic analysis result from the traffic analysis 
unit into a predetermined report type and stores the processed data in the data storing unit, and 
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the report is displayed to the user through the user interface. 

8. (Canceled) 

9. (Currently Amended) A traffic analysis method performed in a traffic measurement 
system that collects packets flowing through Internet links between routers, analyzes traffic, and 
identifies the applications of the packets, the method comprising: 

classifying a first traffic type whose applications are identified using only port numbers 
included in flow data that is processed into a predetermined type; 

classifying a second traffic type whose applications are identified by collecting 
application headers and application signature that are included in payload of the packets, from 
the flow data remaining after the first traffic type is classified; 

classifying a third traffic type whose applications are identified by analyzing the flow data 
remaining after the second traffic type is classified and reverse-direction flow data of the flow 
that are measured at different points as a whole, wherein the third traffic type is identified based 
on an application signature from other flows since the port numbers are exchanged through other 
control flows; 

classifying a fourth traffic type whose applications are identified by analyzing the flow 
data remaining after the third traffic type is classified and flow data measured at different points, 
since port numbers for the applications are not predetermined; and 

classifying a fifth traffic type whose applications cannot be identified using the flow data 
remaining after the fourth traffic type is classified ; and 

taking statistics on traffic classified into the fifth traffic type in order to monitor the 
applications and storing the statistics result, after classifying the fifth traffic type . 

10. (Original) The traffic analysis method of claim 9, wherein the flow data is packets having 
the same target address, the same protocol, and the same port number among the packets flowing 
through the Internet lines. 

1 1 . (Original) The traffic analysis method of claim 9, further comprising determining 
whether identification data of the fourth traffic type is present in traffic included classified into 
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the first traffic type and extracting and storing the application signature of the fourth traffic type, 
after classifying the first traffic type. 

12. (Original) The traffic analysis method of claim 9, further comprising extracting and 
storing the application signature of traffic classified into the third traffic type when traffic 
classified into the second traffic type is backward traffic of traffic classified into the third traffic 
type, after classifying the second traffic type. 

13. (Original) The traffic analysis method of claim 9, further comprising determining 
whether identification data of the fourth traffic type is present in traffic classified into the second 
traffic type and extracting and storing the application signature of the fourth traffic type, after 
classifying the second traffic type. 

14. (Canceled) 

15. (Original) The traffic analysis method of claim 9, further comprising processing the 
classified traffic types into predetermined report types desired by a user and storing or providing 
the processed report through a user interface, after classifying the fifth traffic type. 

16. (Canceled) 

17 (New) The traffic measurement system of claim 1, wherein the analysis server receives 
the traffic data from the plurality of measurement devices as a whole. 
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